Run CI once per PR commit, not twice - #2
Merged
Merged
Conversation
ssh-keygen -l validates structure, not authenticity. Flipping one bit in a key's material leaves a line that still parses, still reports 256-bit ED25519, and still passes every check we had -- only the fingerprint moves. Demonstrated: both the original and the tampered line exit 0 under ssh-keygen -lf. A key corrupted that way would have deployed, reached a new machine's authorized_keys and silently not worked, because no private key matches it. You would believe you had four ways into that box and have three. fingerprints.txt now pins the SHA256 of every key and validate.sh refuses to build while it and keys.txt disagree. Regenerate with scripts/fingerprints.sh and commit both together. The pin also buys reviewability, which may matter more: a reviewer skims past a 68-character base64 blob, but a changed SHA256 line is legible. Key material cannot change without the change appearing in a readable form in the same diff. Verified against the bit-flip, an added key, a removed key and a missing fingerprints.txt -- all blocked -- and that regenerating unblocks. An earlier attempt at the last case failed because the key I appended reused an existing blob and tripped the duplicate guard instead; the test was wrong, not the code.
'push:' with no branch filter fired alongside 'pull_request:', so every pull request commit ran the whole suite twice -- two identical Checks and two identical E2E runs, visible on PR #1. Restricting the push trigger to main leaves one run per PR commit plus one on main after a merge, which is what verifies the squashed result rather than the branch head. Tradeoff: a branch pushed with no PR open now gets no CI. That is the right way round, because main is protected by required status checks and nothing reaches it without a PR.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
keys | 73e393a | Aug 28 2026, 07:24 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
push:with no branch filter fired alongsidepull_request:, so every PR commit ran the suite twice. PR #1 showed two identicalChecksand two identicalE2Eruns.push: branches: [main]leaves one run per PR commit, plus one onmainafter a merge — which verifies the squashed result rather than the branch head.Tradeoff: a branch pushed with no PR open gets no CI. Right way round here, since
mainis protected and nothing reaches it without a PR.This PR is its own test: it should show 3 checks, not 5.